The Terrorism (Protection of Premises) Act 2025 puts a duty on a named responsible person. For a single venue that is manageable with the free templates the Home Office and ProtectUK already publish, and if that is your situation you should use them.
It stops being manageable at scale. Forty premises means forty capacity figures, each one determining a different tier, each tier carrying different duties, each procedure ageing at a different rate, and staff turnover quietly eroding the one thing you thought was settled. The failure is rarely that nobody wrote anything down. It is that nobody can find the version that was current on the day it mattered.
That is a record-keeping problem before it is a security problem, and record-keeping is what software is genuinely good at.